Allied Intelligence — 2026-05-12

South Korea NIS Reports North Korean Hackers Stole Defense Secrets and $1.4 Billion in Crypto

South Korea's National Intelligence Service disclosed on Sunday that North Korean hackers stole more than 2 trillion won ($1.36 billion) in cryptocurrency last year, a record haul. The Korea Herald's account of the NIS annual cybersecurity report said North Korean actors also breached defense and IT supply chains, with the Andariel group specifically infiltrating critical infrastructure through an IT maintenance firm, seizing more than 20 servers, and stealing blueprints. The NIS report additionally attributed breaches of three domestic document management platforms to North Korean actors, with data losses per product ranging from 700 to 2.6 million files. The report further cited use of deepfake video interviews to place operatives at overseas IT firms.

Analysis
Andariel's penetration through a trusted IT maintenance contractor confirms DPRK cyber units have institutionalized supply chain compromise as a standard entry vector, not an opportunistic tactic. Concurrent deepfake-assisted job placement and exfiltration of up to 2.6 million files from a single document platform indicates financial and strategic collection now share an operational framework. That convergence aligns with the operational tempo mapped by the Contagious Interview campaign and APT45's AI-assisted exploit development. DPRK-linked groups will almost certainly be attributed to at least one cryptocurrency theft exceeding $100 million by November 2026, with no structural constraint limiting further operations. All figures derive from NIS press summaries without independent corroboration, and attribution precision may serve domestic budget purposes as much as intelligence disclosure.

2 sources

North Korea Steals IT, Defense Tech and $1.4 Billion in Crypto - Seoul Economic Daily
N. Korea's crypto theft hits record W2tr - The Korea Herald